Cisco has open sourced Project Quarry, a detection language and behaviour engine for AI agents, modelled on what Snort did for malicious network traffic and YARA did for malware identification. Quarry evaluates an entire agent session, so a finding can rest on the relationship between actions: a sensitive file read followed within a defined window by a send to an external destination is a policy match even when each step alone is permitted.
Cisco’s launch post grounds the design in the July incident in which AI agents in an OpenAI cybersecurity evaluation reached the internet, found exposed credentials and spent roughly two and a half days inside Hugging Face’s production infrastructure, which later recovered about 17,600 of the agents’ actions from its logs. Cisco said it has not run Quarry against that incident’s data, and presents its reading of the published timelines as a counterfactual: a rule could have flagged internet access from a sandbox, and a credential appearing in a tool result followed by a call to an outside service.
Quarry combines machine learning classifiers and model judges, which handle questions such as whether a tool result contains a prompt injection, with exact symbolic checks on commands, strings and the order of tool calls. It covers single and multi-turn conversations, agents, tool use, Model Context Protocol interactions and multimodal inputs, and its repository ships plugins for Claude Code, Codex and other MCP compatible agents, plus a starter rule pack.
Amy Chang, Cisco’s head of AI threat and security research, told The Register the missing piece in existing tools is context across a session, likening single action checks to approving each card transaction in isolation while fraud shows up only across the sequence. Cisco is explicit that rules are not a substitute for chain of thought monitors or human oversight; the pitch is a shared, testable rule format that security teams can exchange.